Buggy code:
if ( ! ( fEntityScanner . skipChar ( ';' ) ) ) { reportFatalError ( "SemicolonRequiredInReference" , new Object [ ] { entityName } ) ; } else if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( ';' ) ; } if ( entityName == ( XMLScanner . fAmpSymbol ) ) { fStringBuffer . append ( '&' ) ; if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>value5:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } else if ( entityName == ( XMLScanner . fAposSymbol ) ) { fStringBuffer . append ( '\'' ) ; if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>value7:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } else if ( entityName == ( XMLScanner . fLtSymbol ) ) { fStringBuffer . append ( '<' ) ; if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>value9:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } else if ( entityName == ( XMLScanner . fGtSymbol ) ) { fStringBuffer . append ( '>' ) ; if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>valueB:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } else if ( entityName == ( XMLScanner . fQuotSymbol ) ) { fStringBuffer . append ( '"' ) ; if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>valueD:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } else { if ( fEntityManager . isExternalEntity ( entityName ) ) { reportFatalError ( "ReferenceToExternalEntity" , new Object [ ] { entityName } ) ; } else { if ( ! ( fEntityManager . isDeclaredEntity ( entityName ) ) ) { if ( checkEntities ) { if ( fValidation ) { fErrorReporter . reportError ( XML_DOMAIN , "EntityNotDeclared" , new Object [ ] { entityName } , SEVERITY_ERROR ) ; } } else { reportFatalError ( "EntityNotDeclared" , new Object [ ] { entityName } ) ; } } fEntityManager . startEntity ( entityName , true ) ; } } } } else if ( c == '<' ) { reportFatalError ( "LessthanInAttValue" , new Object [ ] { null , atName } ) ; fEntityScanner . scanChar ( ) ; if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( ( ( char ) ( c ) ) ) ; } } else if ( ( c == '%' ) || ( c == ']' ) ) { fEntityScanner . scanChar ( ) ; fStringBuffer . append ( ( ( char ) ( c ) ) ) ; if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( ( ( char ) ( c ) ) ) ; } if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>valueF:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } else if ( ( c == '\n' ) || ( c == '\r' ) ) { fEntityScanner . scanChar ( ) ; fStringBuffer . append ( '<seq2seq4repair_space>' ) ; if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( '\n' ) ; } } else if ( ( c != ( - 1 ) ) && ( XMLChar . isHighSurrogate ( c ) ) ) { if ( scanSurrogates ( fStringBuffer3 ) ) { fStringBuffer . append ( fStringBuffer3 ) ; if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( fStringBuffer3 ) ; } if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>valueI:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } } } else if ( ( c != ( - 1 ) ) && ( isInvalidLiteral ( c ) ) ) { <START_BUG> reportFatalError ( "InvalidCharInAttValue" , new Object [ ] { Integer . toString ( c , 16 ) , atName , eleName } ) ; <END_BUG> fEntityScanner . scanChar ( ) ; if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( ( ( char ) ( c ) ) ) ; } } c = fEntityScanner . scanLiteral ( quote , value ) ; if ( entityDepth == ( fEntityDepth ) ) { fStringBuffer2 . append ( value ) ; } normalizeWhitespace ( value ) ; } while ( ( c != quote ) || ( entityDepth != ( fEntityDepth ) ) ) ; fStringBuffer . append ( value ) ; if ( XMLScanner . DEBUG_ATTR_NORMALIZATION ) { System . out . println ( ( ( "**<seq2seq4repair_space>valueN:<seq2seq4repair_space>\"" + ( fStringBuffer . toString ( ) ) ) + "\"" ) ) ; } value . setValues ( fStringBuffer ) ; fScanningAttribute = false ; } nonNormalizedValue . setValues ( fStringBuffer2 ) ; int cquote = fEntityScanner . scanChar ( ) ; if ( cquote != quote ) { reportFatalError ( "CloseQuoteExpected" , new Object [ ] { atName } ) ; } } protected void scanExternalID ( String [ ] identifiers , boolean optionalSystemId ) throws IOException , XNIException { } protected boolean scanPubidLiteral ( XMLString literal ) throws IOException , XNIException { } protected void normalizeWhitespace ( XMLString value ) { } public void startEntity ( String name , XMLResourceIdentifier identifier , String encoding ) throws XNIException { } public void endEntity ( String name ) throws XNIException { } protected int scanCharReferenceValue ( XMLStringBuffer buf , XMLStringBuffer buf2 ) throws IOException , XNIException { } protected boolean isInvalid ( int value ) { } protected boolean isInvalidLiteral ( int value ) { }

Fix:
reportFatalError ( "InvalidCharInAttValue" , new Object [ ] { eleName , atName , Integer . toString ( c , 16 ) } ) ;